Appearance
Regulatory Inspections
Where to find it: Audit & Inspection, then Regulatory Inspections (/inspections).
A Regulatory Inspection (INS-YYYY-NNNN) is the container for a supervisory interaction: an examination, a thematic review, a desk review or an ad-hoc inquiry from a competent authority.
Inspection types
| Type | Meaning |
|---|---|
supervisory_examination | A formal supervisory examination |
thematic_review | A review of a specific theme across firms |
on_site_inspection | An on-site visit |
desk_review | A remote review of submitted material |
ad_hoc_inquiry | A specific supervisory question |
Lifecycle
| Status | Meaning |
|---|---|
active | The inspection is live |
drafting_response | A response package is being prepared |
in_review | The response is under governed review |
response_submitted | A formal response has been submitted |
follow_up | Supervisory follow-up in progress |
closed | Concluded |
archived | Retained for the record |
What an inspection carries
| Field | Purpose |
|---|---|
| Business reference | INS-YYYY-NNNN |
| Authority | The supervisory body |
| Inspection type | The classification above |
| External reference | The authority's own notice or reference number |
| Title and description | Context |
| Coordinator and accountable owner | Who runs it, and who is accountable |
| Received, start, end, report dates | The timeline |
| Response deadline | When a response is due |
| Submitted date and by | The submission record |
| Sign-off status and stage | The governed approval record |
| Response package | The formal statement and remediation roadmap |
| Historical snapshots | Immutable frozen packages as submitted |
| Regulator acknowledgement and feedback | The authority's response |
Response deadlines, report dates and commitment milestones project into the GRC Calendar.
Correspondence
Every interaction with the authority is logged:
| Type | Use |
|---|---|
letter_received | Correspondence received from the authority |
response_sent | Correspondence sent |
meeting_notes | A record of a meeting |
clarification_request | A request for clarification, in either direction |
status_update | A progress update |
A complete correspondence log is not administrative tidiness. When an examination runs for eight months across three coordinators, it is the only reliable record of what was actually said.
Scope
Inspections link to canonical objects — legal entities, departments, business services, assets, third parties, engagements, controls, risks and requirements — using the same universal scope mechanism as everything else.
Dual wording preservation
The regulator's exact wording is preserved separately
Every inspection observation preserves the exact verbatim wording used by the authority, held separately from your internal technical interpretation and root cause analysis.
The two are never merged. When you later report on remediation, you can quote the observation as written rather than as you understood it — and any divergence between the two is visible rather than silently absorbed.
Working with Continuous Assurance off
Regulatory inspection management is fully functional with the Continuous Assurance entitlement disabled. It requires the regulatory_inspections entitlement.
Permissions
| Action | Permission |
|---|---|
| View inspections, reports, candidates, items and responses | inspection.read |
| Create, edit and coordinate inspections and correspondence | inspection.manage |
| Ingest reports and run candidate extraction | inspection.extract |
| Confirm candidates and canonicalise them | inspection.canonicalize |
| Review and approve formal response packages | inspection.signoff |
| Generate AI advisory extractions and drafts | inspection.ai_assist |
Example
Inspection INS-2026-0002 — Thematic review of outsourcing governance.
| Field | Value |
|---|---|
| Authority | Prudential supervisor |
| Type | thematic_review |
| External reference | The authority's notice number |
| Received | 14 February |
| Response deadline | 30 April |
| Coordinator | Head of Compliance |
| Accountable owner | Chief Risk Officer |
Scope links: the group legal entity, the outsourcing business service, eleven material third-party engagements, four controls and six requirements.
Correspondence log:
| Date | Type | Summary |
|---|---|---|
| 14 Feb | letter_received | Notice of thematic review with information request |
| 28 Feb | response_sent | Information submission, 14 items |
| 12 Mar | meeting_notes | On-site meeting with the supervisory team |
| 3 Apr | letter_received | Draft observations, 9 items |
| 24 Apr | response_sent | Formal response package |
| 19 May | letter_received | Acknowledgement, two items closed, seven under follow-up |
Six months later, when a new Head of Compliance asks what was agreed in the 12 March meeting, the answer is in the log.
Troubleshooting
"Should this be an inspection or an audit engagement?" If an external authority initiated it under supervisory powers, it is an inspection. If your own third line initiated it under the audit plan, it is an engagement.
"Regulatory Inspections is not visible." Requires the regulatory_inspections entitlement and inspection.read.
"The response deadline is not on the calendar." Check that the deadline is recorded on the inspection record.